News feed
Topics
22 items · Page 1 of 2
Brief · Security
CISA says attackers have started exploiting a maximum-severity GitLab vulnerability patched earlier this month. The sources give no details on affected versions or scale.
Brief · Security
Cisco released updates for a denial-of-service zero-day in ASA and FTD software. Attackers are already using it to crash vulnerable firewalls remotely.
Brief · Security
CISA told federal agencies to patch a high-severity Linux kernel privilege escalation bug. Attackers are chaining it with the PHP2Shell flaws in the wild.
Brief · Security
Tailscale says its security team is patching almost a dozen vulnerabilities in its SSH implementation. The flaws could allow credential theft, server crashes and root privilege escalation.
Brief · Security
Attackers have exploited the two PHP RCE flaws CVE-2026-109618 and CVE-2026-109619, tracked as PHP2Shell. Servers running PHP remain at risk until patched.
Analysis · Security
How CVE-2026-109618 and CVE-2026-109619 work, why a PHP version check misleads, what the four-day exploitation puzzle means, and how to test your servers.
Brief · Security
PHP released emergency patches for two RCE flaws, PHP2Shell. Amazon says attackers started exploiting them four days before the patch date.
Brief · Security
Drupal released fixes for two critical flaws that could allow remote code execution on any supported version. The project warns exploits may emerge soon.
Analysis · Security
How to prove a Magento or Adobe Commerce store is patched, hunt for webshells and tampered templates, and roll out the BlockStrap fix without breaking the storefront.
Brief · Security
Candiru spyware reached devices at Al Jazeera Media Network through targeted online ads. The attack needed only that the malicious ad be rendered, with no click.
Analysis · Security
The first 72 hours after an actively exploited VPN, gateway or firewall zero-day: exposure scans, log checks, config diffs, containment gates and the evidence to keep.
Brief · Security
BeyondTrust told customers to patch a critical Remote Support flaw that attackers have exploited as a zero-day since late August.